Network zones (company networks in policies)

Network zones classify each connection by the IP address the server sees. Policy rules can then allow or refuse by zone, for example requiring a passkey outside the company network.

Which zones are there?

«The server classifies each connection by the verifiable network address and the organization's CIDRs.» Headers sent by the browser do not decide the zone.

How do I set the zones?

1. Open «Manage» › «Policy» › «Network zones» and choose «Read current zones».
2. In «Zones and CIDR in JSON», write the list of zones (up to three) with their CIDRs (up to 1024 in total).
3. Review the full replacement: an empty list removes every managed zone.
4. Approve on your phone or with your passkey. The phone shows «Replace the network zones» and each zone.

If another administrator changed the zones first, the change is refused and nothing is applied.

How do I use a zone in a rule?

Add the condition { "type": "network_zone_any", "values": ["corporate"] } to the rule. «An unknown network does not authorize access: verifiable context is missing.» Select only known zones.

Example: allow phone approval only inside the company network and require a passkey outside it, with two rules.

Cautions

• If the service sits behind a proxy that hides the real IP, the classification loses value; check with your provider.
• Test with «Test decision» before activating.